[PATCH v10 29/69] drm/rockchip: dw_hdmi_qp: Fix invalid drvdata access in PM ops

[Cristian Ciocaltea]

The system-sleep PM callbacks fetch the driver state via
dev_get_drvdata() and dereference it unconditionally.  However, the
platform device is bound by ->probe(), which merely registers a
component, hence the callbacks may well run when no valid state is
available:

- Before the aggregate driver calls ->bind(), e.g. when the system
  suspends while probing is still deferred waiting for the VOP,
  dev_get_drvdata() returns NULL.

- After ->unbind(), or when ->bind() fails past platform_set_drvdata(),
  drvdata is left pointing to memory obtained via drmm_kzalloc(), which
  is released together with the DRM device, while this platform device
  remains bound and PM-capable.

Publish the driver data only after ->bind() completes successfully, and
clear it in ->unbind().  This ensures that a non-NULL drvdata always
represents live state, allowing each PM callback to rely on a single
NULL check.

Fixes: 128a9bf8ace2 ("drm/rockchip: Add basic RK3588 HDMI output support")
Reported-by: Sashiko <sashiko-...@kernel.org>
Closes: https://lore.kernel.org/all/20260702151550.8e14d1f00...@smtp.kernel.org/
Closes: https://lore.kernel.org/all/20260723014811.1f9f01f00...@smtp.kernel.org/
Signed-off-by: Cristian Ciocaltea <cristian.ciocal...@collabora.com>
---
 drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c 
b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
index 9c4cf68d79d5..646a4cb96830 100644
--- a/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c
@@ -683,8 +683,6 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, 
struct device *master,
        if (ret)
                return dev_err_probe(hdmi->dev, ret, "Failed to init encoder");
 
-       platform_set_drvdata(pdev, hdmi);
-
        hdmi->hdmi = dw_hdmi_qp_bind(pdev, encoder, &plat_data);
        if (IS_ERR(hdmi->hdmi))
                return dev_err_probe(hdmi->dev, PTR_ERR(hdmi->hdmi),
@@ -695,6 +693,8 @@ static int dw_hdmi_qp_rockchip_bind(struct device *dev, 
struct device *master,
                return dev_err_probe(hdmi->dev, PTR_ERR(connector),
                                     "Failed to init bridge connector\n");
 
+       platform_set_drvdata(pdev, hdmi);
+
        return 0;
 }
 
@@ -704,6 +704,8 @@ static void dw_hdmi_qp_rockchip_unbind(struct device *dev,
 {
        struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev);
 
+       dev_set_drvdata(dev, NULL);
+
        cancel_delayed_work_sync(&hdmi->hpd_work);
 }
 
@@ -726,7 +728,8 @@ static int __maybe_unused 
dw_hdmi_qp_rockchip_suspend(struct device *dev)
 {
        struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev);
 
-       dw_hdmi_qp_suspend(dev, hdmi->hdmi);
+       if (hdmi)
+               dw_hdmi_qp_suspend(dev, hdmi->hdmi);
 
        return 0;
 }
@@ -735,6 +738,9 @@ static int __maybe_unused dw_hdmi_qp_rockchip_resume(struct 
device *dev)
 {
        struct rockchip_hdmi_qp *hdmi = dev_get_drvdata(dev);
 
+       if (!hdmi)
+               return 0;
+
        hdmi->ctrl_ops->io_init(hdmi);
 
        dw_hdmi_qp_resume(dev, hdmi->hdmi);

-- 
2.55.0